常见的这种混淆如下:
ast解混淆如下:
const fs =require('fs');
//js转AST代码
const parser =require('@babel/parser');
//遍历ASR节点
const traverse =require('@babel/traverse').default;
//用来判断节点类型产生新的节点
const t =require('@babel/types');
//用来把AST转换成js代码
const generator =require('@babel/generator').default;
const jscode=fs.readFileSync("./bb.js", {
encoding:"utf-8"
});
const visitor1={
CallExpression(path){
if(path.node.callee.type=="Identifier"){
if(path.node.callee.name==this.asdf){
path.node.callee.name="_0x305c"
console.log(path.node.callee.name);
}
}
},
};
const visitor2={
"FunctionExpression|FunctionDeclaration"(path){
if(path.node.body.body.length>0){
if(path.node.body.body[0].type=="VariableDeclaration"&&path.node.body.body[0].declarations.length>0){
if(path.node.body.body[0].declarations[0].init.name==this.asdf){
console.log("是的");
console.log(this.asdf);
console.log(path.node.body.body[0].declarations[0]);
let asdf=path.node.body.body[0].declarations[0].id.name;
path.traverse(visitor1,{asdf});
path.traverse(visitor2,{asdf});
}
}
}
}
};
const visitor = {
"FunctionExpression|FunctionDeclaration"(path){
if(path.node.body.body.length>0){
if(path.node.body.body[0].type=="VariableDeclaration"&&path.node.body.body[0].declarations.length>0){
//console.log(path.node.body.body[0].declarations[0].id);
//console.log(path.node.body.body[0].declarations[0].init);
if(path.node.body.body[0].declarations[0].init.name=="_0x305c"){
let asdf=path.node.body.body[0].declarations[0].id.name;
console.log("看这里");
console.log(asdf);
//console.log(path.node.body.body[0].declarations[0].id.name);
path.traverse(visitor1,{asdf});
path.traverse(visitor2,{asdf});
}
}
}
}
};
let ast=parser.parse(jscode);
traverse(ast,visitor);
let code =generator(ast).code;
fs.writeFile('./bbafter.js',code,(err)=>{});